CVE-2025-53018 Details
Description
Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources—such as localhost services or cloud-provider metadata endpoints—become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue.
A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in Lychee photo management tool, in versions prior to 6.6.13. The vulnerability exists in the '/api/v2/Photo::fromUrl' endpoint, where user-supplied URLs are sent to the server via 'fopen()' without any validation or restrictions. This allows attackers to make requests to internal network resources, such as localhost services or cloud provider metadata endpoints. Exploitation of this vulnerability could lead to internal port scanning or unauthorized access to sensitive cloud metadata.
Users are advised to update to Lychee version 6.6.13 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 27, 2025CISA-ADP
Assessed Jun 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LycheeOrg/Lychee/commit/9dc162eefe56ce185ac1d59da42ee557933d914d | [email protected] | Source CodeVendor |
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lychee | <= 6.6.12 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 27, 2025 | CVE Modified | CISA-ADP |
| Jun 27, 2025 | New CVE Received | [email protected] |